CVE-2025-27105: Vyper AugAssign Evaluation Order Vulnerability Leading to Out-of-Bounds Write
Summary
CVE-2025-27105: AugAssign evaluation order causing OOB write within the object in Vyper. Affects vyper versions < 0.4.1. Fixed in 0.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Vyper is a Python-based programming language designed for writing smart contracts on the Ethereum blockchain. It emphasizes security, simplicity, and readability, making it a popular choice for developers in the decentralized finance (DeFi) space. However, Vyper is susceptible to a specific vulnerability related to the AugAssign statements, which can lead to unintended behavior and potential security risks.
Vulnerability Detail
The vulnerability arises from the way Vyper handles AugAssign statements. When an AugAssign operation is performed, Vyper caches the target location to prevent double evaluation. If the target is a dynamic array (DynArray) and the right-hand side (rhs) modifies the array, the cached target is evaluated first. This means that the bounds check is not re-evaluated during the write operation, leading to an out-of-bounds (OOB) write. For example, the code 'a[1] += a.pop()' can result in accessing an invalid index, which can cause unexpected behavior or crashes.
How To Fix
Latest published version: 0.4.3 as of 22 Oct 2026
pip install --upgrade "vyper==0.4.3"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.1
This is the first release that contains the fix.
pip install --upgrade "vyper==0.4.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using AugAssign statements with dynamic arrays where the rhs modifies the array. Instead, break down the operation into separate statements to ensure proper evaluation order. For example, modify the code as follows:
def poc():
a: DynArray[uint256, 2] = [1, 2]
s: uint256 = a[1]
t: uint256 = a.pop()
a[1] = s + t # This prevents OOB access
Conclusion
CVE-2025-27105 highlights a critical vulnerability in Vyper related to AugAssign evaluation order, which can lead to out-of-bounds writes. It is essential for developers using Vyper to update to version 0.4.1 or later and to implement workarounds where necessary to ensure the security and stability of their smart contracts.
See every vulnerability recorded for vyper →
FAQ
The impact includes potential out-of-bounds writes, which can lead to unexpected behavior, crashes, or security vulnerabilities in smart contracts.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
Versions of Vyper up to and including 0.4.0 are affected. Version 0.4.1 and later contain the fix.
Yes, you can avoid using AugAssign statements with dynamic arrays or break down operations into separate statements to ensure proper evaluation order.
If immediate updates are not possible, implement the suggested workarounds to minimize the risk until you can upgrade to a patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for vyper.
